The technical definition of password strength already exists in terms of bits of entropy. Essentially, it's the number of guesses required to arrive at a given password. A password that is 4 digits long has 10,000 possible values, so only 10,000 guesses or less would be required to guess it. These are expressed in powers of 2; 10,000 is approximately 2^14, so we would say it has 14 bits of entropy.
But computing hashes isn't the whole story. Beyond that, there are ways system owners improve security by using a better hashing algorithm, a better protocol such as PBDKF2 or bcrypt, applying salt, throttling guesses, custom hardware, etc. Rate limiting is very effective if you control the hardware: an iPhone passcode has only 2^14 bits of strength, but the custom chip built inside the machine will destroy its secret embedded encryption keys if the wrong passcode is entered 10 times.
On the other end of the scale, 2^80 bits of entropy are approaching the limits of imaginable attacks. It seems unlikely today that anyone could brute force crack an 80 bit password at home; it seems almost unthinkable that any entity ever could brute force crack a 128 bit key. The iPhone being studied by the FBI uses encryption keys that have 256 bits of entropy, and at this we know of no way to brute force those. Yet advances in mathematics and cryptographic research, and advances in hardware (such as quantum computing), have proven time and again that nothing should be declared uncrackable.
And defense is only half the picture. There are ways attackers can improve their attacks besides the custom parallelization mentioned above: they can use wordlists and tools like John the Ripper to prioritize guessing passwords based on the language of the user, rainbow tables are easily downloaded, collisions, malware, research on the target, zombies in a captive botnet, and other techniques can all reduce the search space. These all depend on the capabilities and dedication of your envisioned adversary.
Given that both offense and defense are not statically defined, each combination of implementation and threat model are specific, and are not really comparable to any other installation. That makes it hard to assign a fixed estimate of cost or time on a basis that is comparable between different password implementations. The most accurate things we can say are "this algorithm has x bits of strength", "this implementation multiplies attacker effort by 60,000", etc.